
Daily Open Source Infrastructure Report 

24 May 2012 



• A new variant of SpyEye malware allows cybercriminals to monitor potential bank fraud 
victims by hijacking their Web cams and microphones, according to security researchers. - 
IDG News Service (See item 10 ) 

• Federal investigators said a Florida man pleaded guilty to heading a multi-million dollar 
identity theft ring that stole thousands of credit card numbers and stretched from Florida to 
Canada and eastern Europe. - WFOR 4 Miami (See item H) 

• Missouri climatologists and farmers said a quick burst of dry heat has parched plants and is 
threatening crops and livestock across the State. - St. Louis Post-Dispatch (See item 19 ) 

• A 40-year-old jet fuel spill threatening Albuquerque, New Mexico’s water supply could be 
as large as 24 million gallons, environment officials said. - Associated Press (See item 28 ) 
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Energy Sector 



Current Electricity Sector Threat Alert Levels: Physical: LOW, Cvher: LOW 

Scale: LOW, GUARDED, ELEVATED, HIGH, SEVERE [Source: ISAC for the Electricity Sector (ES-ISAC) - 
rhttp://www.esisac.com1 



1 . May 22, Anchorage Daily News - (Alaska) Prudhoe Bay spill of 4,200 gallons of oil, 
water contained. A tank at a Prudhoe Bay processing center in Anchorage, Alaska, 
operated by BP, overflowed May 21. An estimated 4,200 gallons of crude oil and oily 
water, the Alaska Department of Environmental Conservation (DEC) said in a report 
May 22. The spilled oil and water were contained in the area by an impermeable liner 
and did not leach out, and the overflow stopped, the DEC said. The mishap occurred at 
Elow Station 2, a BP processing facility on the North Slope to separate oil, natural gas, 
and water. Instruments and valves used to control the level of fluids in the tank 
malfunctioned somehow. An alarm went off, and a BP worker checking it discovered 
the spill, said a BP spokesman. 

Source: http://www.adn.eom/2012/05/22/2476038/prudhoe-bav-spill-of-4200- 
gallons.html 

2. May 22, Power Engineering - (Michigan) Worker injured after explosion at DTE 
coal-fired power plant. One worker suffered minor injuries after an explosion in a 
coal bunker at DTE Energy’s 1,400 megawatt coal-fired power plant in St. Clair, 
Michigan. The explosion happened May 20 and was currently under investigation May 
22. A company spokesman said the plant’s fueling system was temporarily shut down 
following the explosion, and one of six generating units was taken out of service. A 
second generating unit was already shut down for maintenance, while the remaining 
four continued operating. Electricity service was not interrupted to customers. 

Source: http://www.power-eng.eom/articles/2012/05/worker-injured-after-explosion-at- 
dte-coal-fired-power-plant.html 

3. May 21, WFLX 29 West Palm Beach - (Elorida) Oil truck tank bursts spilling fuel 
onto road. One lane of Palm Beach Eakes Boulevard and Australian Avenue in West 
Palm Beach, Elorida, was blocked after an oil-truck tank burst, spilling fuel into the 
roadway May 21. According to a West Palm Beach spokesman, 275 gallons of oil 
spilled from the tank. The department of environmental protection and West Palm 
Beach Eire Rescue crews responded and cleaned the intersection. 

Source: http://www.wflx.com/storv/18574733/oil-spill-closes 

Eor more stories, see items 2^ and 44 
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Chemical Industry Sector 

4. May 23, WAFB 9 Baton Rouge - (Eouisiana) 4 hospitalized after being exposed to 
chlorine. Eour Georgia Gulf contract employees were recovering after being exposed 
to chlorine at a chemical and vinyls plant in Plaquemine, Eouisiana, May 22. A Georgia 
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Gulf spokesman said the four were near a railcar when the chlorine was being 
offloaded, but they were not the ones handling it. He said things were quickly brought 
under control, and there was no need for road closures or evacuations. The four 
employees were sent to the hospital. 

Source: http://www.wafb.com/storv/18601433/4-hospitalized-after-being-exposed-to- 
chlorine 



5. May 23, Baton Rouge Advocate - (Louisiana) WBR evacuation lifted, U.S. 190 
reopened. The mandatory evacuation for residents in a 1-mile radius around the Air 
Liquide Speciality Chemicals plant in Port Allen, Louisiana, has been lifted and U.S. 
190 has been reopened in both directions, a Louisiana State Police (LSP) spokesman 
said. The road reopened and the evacuation was lifted mid-morning. May 23, a day 
after more than 500 fires ignited amongst thousands of acetylene gas cylinders at the 
plant. The conflagration led officials to evacuate about 250 people, as well as some 
businesses, and to shut down a 14-mile stretch of U.S. 190. Although emergency 
officials are still cleaning up the wreckage left behind from the fire, it is safe for 
residents to go back home and for motorists to travel near the site, the LSP spokesman 
said. 

Source: http://theadvocate.eom/home/2907897-77/wbr-evacuation-lifted-us-190 
For another story, see item 16 
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Nuclear Reactors, Materials and Waste Sector 

6. May 22, Cape Cod Times - (Massachusetts) Condenser issues prompt Pilgrim shut 
down. The Pilgrim Nuclear Power Station in Plymouth, Massachusetts, was manually 
shut down May 22 while at reduced power during a condenser cleaning operation, a 
federal nuclear official said. During the cleaning the condenser began to lose vacuum 
and the reactor was shut down. Resident inspectors with the Nuclear Regulatory 
Commission did not identify any safety concerns or performance issues, a spokesman 
said, adding that they would follow the company’s efforts to troubleshoot the problem. 
Once the cause is found and any necessary repairs are made the plant will be brought 
back online, an Entergy spokesman said. 

Source: 

http://www.capecodonline.com/apps/pbcs.dll/article?AID=/20120522/NEWSl 1/12052 
9920/-1/NEWSMAP 

r Return to top i 

Critical Manufacturing Sector 

Nothing to report 



[ Return to top] 



- 3 - 



Defense Industrial Base Sector 



7. May 23, Global Security Newswire - (National) DOD pledges action against suspect 
electronics. A planned U.S. Defense Department initiative would bolster efforts to 
prevent armed forces hardware from incorporating off-brand components from China, 
the Washington Times reported May 22. May 22, a Defense Department spokesman 
said the Pentagon is “working very hard to try to sort this issue out, and take steps to 
further strengthen our supply chain.” In a related move, the department finali z ed 
instructions in March aimed at laying the groundwork for a formal initiative to target 
illicit defense components. Bolstering transparency mandates for companies hired by 
the government is the goal of a collaborative effort by the White House and Pentagon, 
the spokesman added. 

Source: http://www.nti.org/gsn/article/defense-department-pledges-action-against-fake- 
defense-electronics/ 

r Return to top i 

Banking and Finance Sector 

8. May 22, Dallas Morning News - (Texas; Mississippi) Richardson man known as 
‘Handsome Guy Bandit’ pleads guilty in string of bank robberies. A bank robber 
dubbed the “Handsome Guy Bandit” for the latex mask he wore during heists has 
admitted his role in a spree of 1 1 bank robberies in Texas in 201 1. He pleaded guilty 
May 22 to charges of brandishing a firearm during or in relation to a crime of violence 
and one count of using, carrying, and brandishing a firearm during or in relation to a 
crime of violence, according to the U.S. attorney’s office. The spree ended in 
December 2011 when authorities said the man walked into a Compass Bank in 
Richardson, Texas. Richardson officers pulled up just as he exited the bank. He opened 
fire on the squad car, shattering the windshield, and escaped. He turned up the next 
morning in Jackson County, Mississippi, where he led authorities on a chase that ended 
when the sheriff shot out his tire. He also committed robberies in Dallas, Plano, and 
Irving. 

Source: http://crimeblog.dallasnews.eom/20I2/05/richardson-man-known-as- 
handsome-guv-bandit-pleads-guilty-in-string-of-bank-robberies.html/ 

9. May 22, Dow Jones Newswires - (International) Treasury says Belarus’s 
CredexBank is money-laundering concern. The U.S. Department of the Treasury 
May 22 named a Belarus-based bank as a “primary money-laundering concern,” a step 
that could cut off its access to the U.S. financial system. JSC CredexBank’s uncertain 
ownership, business activities and customers put U.S. financial institutions at risk. 
Treasury said. Treasury made the designation under Section 31 1 of the USA Patriot 
Act. The under secretary for terrorism and financial intelligence, in a call with 
reporters, said the announcement puts U.S. banks on notice to assess any exposure they 
have to Credex and takes steps to protect themselves. Treasury also has proposed 
measures to prohibit U.S. banks from conducting most transactions with Credex, 
cutting off access to the U.S. financial system. He said Credex had engaged in “highly 
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suspicious” transactions, but did not say that the bank had violated any sanctions, or 
name any individuals who might be behind its operations. 

Source: http://www.foxbusiness.com/news/2012/05/22/treasury-savs-belarus- 
credexbank-is-money-laundering-concem/ 

10. May 22, IDG News Service - (International) Banking malware spies on victims by 
hijacking webcams, microphones, researchers say. A new variant of SpyEye 
malware allows cybercriminals to monitor potential bank fraud victims by hijacking 
their Web cams and microphones, according to security researchers from Kaspersky 
Lab May 21. SpyEye is a computer trojan that specifically targets online banking users. 
Like its older cousin, Zeus, SpyEye is no longer being developed by its original author 
but is still widely used by cybercriminals. SpyEye’ s plug-in-based architecture allows 
third-party malware developers to extend its original functionality, a Kaspersky Lab 
malware researcher said. This is exactly what happened with the new Web cam and 
microphone spying feature, implemented as a SpyEye plug-in called 
flashcamcontrol.dll, he said. As suggested by the DLL’s name, the malware accesses 
the two computer peripherals by leveraging Elash Player, which has Web cam and 
microphone control functionality built in. Under normal circumstances, users get 
prompted to manually allow Web sites to control their computers’ Web cam and 
microphone via Elash. However, the SpyEye plug-in silently whitelists a list of online 
banking Web sites by directly modifying Elash Player configuration files. 

Source: 

http://www.computerworld.eom/s/article/9227387/Banking malware spies on victims 
by hijacking webcams microphones researchers say 

11. May 22, WFOR 4 Miami - (Elorida; International) Feds bust multi-million dollar 
identity theft ring. Homeland Security inyestigators said they found a laptop 
computer, a credit card reader, and other eyidence in the southwest Miami-Dade, 
Elorida home of a man accused mastermind of a multi-million dollar identity theft ring 
stretching from south Elorida to Canada and eastern Europe, WEOR 4 Miami reported 
May 22. A federal agent said the man made tons of phony credit cards out of his home 
— realistic even down to the foil markings on the back of the card. Agents said he 
made the cards with thousands of stolen credit card numbers purchased from criminal 
groups in Canada and Eastern Europe. It is believed the stolen numbers were acquired 
through a myriad of ways, including home break-ins and through large scale rip-offs of 
data. The federal agent said the man had his employees buy prepaid gift cards with the 
phony credit cards, which made it more difficult to trace his operation. She said those 
gift cards were then sold at a discount online. Investigators believe the operation made 
at least $4 million. When the feds searched the man’s house, they found small bags 
crammed full of fraudulent credit cards and a hard drive with a trove of credit card 
numbers. Eederal investigators said the man pleaded guilty to the charges. 

Source: http://miami.cbslocal.eom/2012/05/22/exclusive-feds-bust-multi-million- 
dollar- identity-theft-ring/ 

12. May 22, Reuters - (National) Man ordered to pay ex-partners $35 min. The founder 
of a hedge fund was found May 22 to have defrauded his former partners and was 
ordered to pay them $35 million. The man, a one-time JPMorgan Chase & Co trader. 
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was ordered by a Delaware Court of Chancery judge to compensate his partners for 
their contributions to starting Paron Capital Management LLC and for lost future 
earnings. According to the May 22 36-page opinion, the partners left lucrative jobs at 
financial firms in 2010 and teamed up with the defendant to market his quantitatively 
based trading program, which was producing returns of 25-38 percent. Less than a year 
after founding Paron, the two learned the defendant had forged account statements and 
investment statements and had hidden personal debts. Accounts the defendant claimed 
held $24 million in fact held $40, according to the judge. “Many of the representations 
[he] made about his track record, employment history, and personal financial situation 
were outright lies,” the judge wrote. The defendant filed for bankruptcy in California in 
February. The partners are also looking to collect from Rothstein, Kass & Co, and 
Yulish & Associates, which had performed independent audits of the man’s track 
record. 

Source: http://www.reuters.eom/article/2012/05/22/hedge-fund-ruling- 
idUSLlE8GMKLO20120522 
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Transportation Sector 

13. May 23, North Andover Eagle-Tribune - (Massachusetts) Odors bring hazmat 
response on Methuen/Dracut line. More than 50 employees were evacuated from 
Con-way Freight in Dracut, Massachusetts, May 22, after employees smelled a 
chemical odor in a trailer that just arrived at the facility, police and fire officials said. 
The Massachusetts State HAZMAT team investigated a chemical smell released from 
several boxes in a trailer outside the main building. Three Con-way employees were 
taken to a medical center for evaluation and possible decontamination as a precaution. 
Fire officials said they were released and returned to work. A deputy fire chief said 
there were two chemicals in three boxes that were of concern because they are very 
hazardous. One was phenyl mercaptan, a chemical used in pesticides and to give odor 
to natural gas, among other uses. The other was chromium trioxide, a red solid used in 
chrome plating. 

Source: http://www.eagletribune.com/local/xl968168418/Odors-bring-hazmat- 
response-on-Methuen-Dracut-line 

14. May 23, Newark Star-Ledger - (New Jersey) Manalapan school bus driver with 
suspended license crashes into lamp post with 37 kids onboard. A school bus 
loaded with elementary school students was being driven by a woman with a suspended 
license when it slid off of a Monmouth County, New Jersey road and crashed into a 
lamp post and tree, police and school officials said May 22. None of the 37 students en 
route to the Lafayette Mills School in Manalapan was injured, said a Manalapan- 
Englishtown Regional Schools superintendent. The bus driver suffered minor cuts and 
was fired from her job, said the superintendent. She was also found to have several 
bench warrants out for her arrest in addition to a suspended license. The accident 
prompted the district to conduct new background checks for bus drivers, the 
superintendent said in a letter to parents posted on the district’s Web site. The status of 
all drivers will be reviewed on a quarterly, rather than an annual, basis. 
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Source: 

http://www.ni.com/news/index.ssf/2012/Q5/manalapan school bus driver with suspe 
nded license crashes into lamp post with 37 kids onboard.html 

15. May 22, WFTS 29 Tampa - (Florida) Power outage at radar center in Jacksonville 
causes delays at Tampa International Airport. A power outage at the Federal 
Aviation Administration’s (FAA) Air Route Traffic Control Center in Hilliard, Florida, 
caused delays at Tampa International Airport (TIA) in Tampa, Florida, May 22. 
According to the FAA, the radar that tracks high altitude flights over north Florida, 
south Georgia, South Carolina, and the Gulf Coast lost power May 21. Even though 
power was restored to the radar, the outage caused residual delays. Six flights at TIA 
were cancelled and several others were delayed. 

Source: http://www.abcactionnews.com/dpp/news/region tampa/power-outage-at- 
radar-center-in-jacksonville-causes-delays-at-tampa- international-airport 

16. May 22, Tampa Bay Times - (Florida) Part of Big Bend Road and U.S. 301 shut 
down after fertilizer truck overturns - Tampa Bay Times. A semitrailer truck 
hauling fertilizer overturned and shut down part of Big Bend Road and U.S. 301 in 
Tampa, Florida, for several hours. May 22. The truck made a left turn too quickly and 
fell on its side, spilling the fertilizer on the road, the Florida Highway Patrol said. The 
right two lanes of southbound U.S. 301 and the right-most lane of westbound Big Bend 
Road were blocked off following the accident. The truck driver was unharmed and was 
cited for failure to use due care, the patrol said. 

Source: http://www.tampabav.com/news/transportation/roads/part-of-big-bend-road- 
and-us-30 1 -shut-do wn-after-fertilizer-truck-overtums/ 1231383 



For more stories, see items 3, 5, 25 , and 46 
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Postal and Shipping Sector 

17. May 22, Eureka Times-Standard - (California) APD detains arson suspect. Areata, 
California detectives detained an unidentified woman May 21 after she allegedly 
confessed to setting a fire inside a post office lobby and attempting to set fire to a 
vehicle. Officers responded to a fire at the Areata Post Office May 20, according to an 
Areata Police Department (APD) press release. They found paper and debris was set on 
fire inside the lobby, the release said. A passerby noticed the fire and extinguished the 
flames using a fire extinguisher. The Areata Fire Department responded and put out the 
remaining fire. The lobby received minor fire damage to two walls as well as smoke 
damage, the police department said. May 21, the police department received a report of 
a person putting a lit cigarette into the fuel tank of a parked vehicle. Officers later 
located a woman who matched the suspect’s description and she confessed to setting 
both fires. 

Source: http://www.times-standard.com/breakingnews/ci 20681022/apd-detains-arson- 
suspect 
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Agriculture and Food Sector 

18. May 23, Food Safety News - (Maryland) Maryland first State to ban arsenic in 
poultry feed. Maryland’s governor signed a bill May 22 banning arsenic in poultry 
feed, making his State the first to have a law against the practice on the books. The new 
law, which takes effect January 1, 2013, prohibits the use, sale, or distribution of 
commercial feed containing arsenic and specifically mentions two Pfizer drugs that 
contain arsenic: Roxarsone, which the company voluntarily withdrew from the market 
in 2011, and Histostat, which is still on the market. The move followed a U.S. Food and 
Drug Administration (FDA) study released the summer of 201 1 that found increased 
levels of inorganic arsenic in the livers of chickens treated with Roxarsone. The new 
data raised concerns of a “very low but completely avoidable exposure to a 
carcinogen,” said the FDA’s deputy commissioner for foods, when FDA announced the 
company was withdrawing the drug in response to the study’s findings. FDA said the 
arsenic levels found in their poultry study are low enough that consumers are not at risk 
eating poultry while Roxarsone is phased out of use in the United States. 

Source: http://www.foodsafetvnews.eom/2012/05/marvland-first-state-to-ban-arsenic- 
in-poultry-feed/ 

19. May 23, St. Louis Post-Dispatch - (Missouri) Missouri farmers battling ‘flash 
drought’. Missouri climatologists and farmers are calling it a “flash drought” — a 
quick burst of dry heat that is parching plants and threatening the State’s crops. “It’s 
rapidly emerging across the state,” said the University of Missouri extension’s State 
climatologist May 22. “It started in the Bootheel, but over the past, two or three weeks, 
much of Missouri has seen negligible rain. We’ve had a lot of above-normal 
temperatures, low humidity and lots of sunshine. The moisture has just evaporated out 
of the vegetation.” The conditions threaten the State’s vulnerable, young com crop, and 
could mean a tough summer for all crop producers, as well as cattle ranchers and dairy 
farmers. “If it stays dry for the next two to three weeks, we’re going to see some die- 
offs,” the climatologist said. Temperatures across Missouri were 4 to 6 degrees above 
normal and rainfall south of Interstate 70 is below normal for the first half of May. The 
Bootheel is already experiencing moderate to severe drought, but those conditions are 
creeping northward. This could be the second summer in a row farmers in the State 
have struggled with dry weather. In 2011, the U.S. Department of Agriculture 
designated 101 Missouri counties natural disaster areas because of drought conditions. 
The loss to the State’s grain farmers was an estimated $350 million, with com farmers 
losing roughly 24 million bushels of yield and soybean farmers about 20 million. Cattle 
ranchers were particularly hard hit because grassland and hay were in short supply. 
Source: http://www.stltodav.com/business/agriculture/missouri-farmers-battling-flash- 
drought/article cl9ebf34-a456-l Iel-a624-0019bb3001a.html 

20. May 22, U.S. Food Safety and Inspection Service - (Nevada) Nevada firm recalls 
lasagna product due to misbranding and an undeclared allergen. West Best Foods, 
Inc., a Las Vegas establishment, recalled about 13,776 pounds of lasagna products 
because of misbranding and an undeclared allergen. The product contains soy, which is 
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an allergen that is not declared on the label, the U.S. Food Safety and Inspection 
Service announced May 22. The products subject to recall are: 24-pound cases of 
“WEST BEST EOODS INC EASAGNA WITH MEAT SAUCE” and 24-pound cases 
of “WEST BEST EOODS INC DEEUXE BEEE EASAGNA.” The products were 
produced between April 13 and May 21 and were distributed to hotels and one 
distributor in Eas Vegas. The problem was discovered during a routine food safety 
assessment and may have occurred as a result of a change in an ingredient formulation 
used in the products. 

Source: 

http://www.fsis.usda.gov/News & Events/Recall 033 2012 Release/index. asp 

21. May 22, WTAM 1100 Cleveland - (Ohio) Quarantine to protect Ohio’s walnut 
trees. In an effort to protect the walnut trees of Ohio, the Ohio Department of 
Agriculture proposed an exterior State quarantine regulating the transportation of 
walnut products from areas of 12 other States to prevent the introduction of Thousand 
Cankers Disease (TCD) to Ohio’s walnut trees, WTAM 1100 AM Cleveland reported 
May 22. TCD primarily affects black walnut trees, as well as other species of walnut, 
and is caused by a fungus transported by the walnut twig beetle. TCD was first found in 
Colorado in 2003 and has since been detected in 1 1 other States. These States include 
parts of Arizona, California, Idaho, Nevada, New Mexico, Oregon, Pennsylvania, 
Tennessee, Utah, Virginia, and Washington. Walnut materials originating from infested 
counties within these States will be regulated under the exterior State quarantine. The 
quarantine would restrict walnut materials from entering Ohio from areas where TCD 
has become established. 

Source: http://www.wtam.com/cc- 

common/news/sections/newsarticle.html?feed=122520&article=10145480 



22. May 22, U.S. Food and Drug Administration - (Northwest) Pacific Coast Fruit 
Company recalls single side serving processed salads for potential Listeria 
monocytogenes contamination. Pacific Coast Eruit Company of Portland, Oregon, 
voluntarily recalled multiple types of bagged processed salads based on the potential 
contamination of Eisteria monocytogenes, the U.S. Eood and Drug Administration 
reported May 22. Pacific Coast Emit utilized a portion of the salads that were recalled 
by River Ranch in some of its retail and food service processed bagged salad. Pacific 
Coast recalled products were distributed to bred Meyer, Avanti, and Evergreen in 
Oregon and in Washington State, Alaska, and Idaho. 

Source: http://www.fda.gov/Safetv/Recalls/ucm3Q5I23.htm 

23. May 22, U.S. Food and Drug Administration - (National) Salinas firm initiates a 
voluntary recall because of possible health risk. Taylor Earms Retail, Inc. initiated a 
voluntary recall of Organic Baby Spinach with the potential to be contaminated with 
Salmonella following a random test conducted on a finished package of spinach by the 
U.S. Department of Agriculture, the U.S. Eood and Drug Administration reported May 
22. The items subject to the recall include: Private Selections Organic - Baby Spinach 
which was distributed in Alaska, Arizona, California, Colorado, Idaho, Kansas, 
Eouisiana, Missouri, Montana, New Mexico, Nevada, Oregon, Texas, Utah, 
Washington, and Wyoming. Also included in the recall is Marketside Baby Spinach - 
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Organic which was distributed in Arizona, Colorado, Idaho, Kansas, Louisiana, 
Missouri, Mississippi, Montana, New Mexico, Nevada, Oklahoma, Texas, Utah, and 
Wyoming. 

Source: http://www.fda.gov/Safetv/Recalls/ucm3052Q3.htm 

24. May 22, Reuters - (International) Earthquake hits cheese production in northern 
Italy. The earthquake that struck northern Italy will affect production and export of 
some of the area’s most internationally famous items — Parmigiano Reggiano and 
Grana Padano cheeses, Reuters reported May 22. National farmers’ group Coldiretti 
estimated damage to agriculture in the area, one of Italy’s most fertile and productive 
zones, at more than $250 million. Some of the worst damage was to the production of 
Parmigiano Reggiano, also called Parmesan cheese, and Grana Padano. Some 300,000 
wheels of Parmigiano Reggiano and 100,000 of Grana Padano, each weighing about 88 
pounds, were damaged when they fell off shelves in warehouses where they were 
undergoing the 2-year-long seasoning process. Coldiretti said some 10 percent of the 
production of Parmigiano Reggiano and 2 percent of Grana Padano was affected by the 
quake. 

Source: http://www.reuters.eom/article/2012/05/22/italv-quake-food- 
idUSL5E8GM9XG20 120522 
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Water Sector 

25. May 23, Atlanta Journal-Constitution - (Georgia) Moores Mill water main repaired, 
road still closed. Crews completed repair work on a broken water main May 23 in 
northwest Atlanta, however Moore’s Mill Road remained closed May 23, a department 
of watershed management spokeswoman said. She expected it to reopen by May 24. 

The incident marked the second time watershed management crews had been at the 
Moores Mill site in recent days. Previously, a break closed the street on one side of the 
Peachtree Creek bridge, and crews stopped the leak so the road could reopen. Then, 
when the city increased water pressure, another break opened up on the opposite side of 
the bridge, and the street again was closed. 

Source: http://www.aic.com/news/atlanta/moores-mill-water-main- 144375 1 .html 

26. May 22, Shelby Star - (North Carolina) Rain blamed for 24,000-gallon sewer 
spill. About 24,000 gallons of sewage spilled into Hickory Creek during a heavy rain 
May 17, the Shelby Star reported May 22. The City of Shelby, North Carolina, 
corrected the sanitary sewer overflow, which was due to a severe rain event, the same 
day, said a city news release. The wastewater was discharged into the creek in the 
Broad River Basin. It was reported to the North Carolina Division of Water Quality. 
Source: http://www.shelbvstar.com/news/sewer-64369-shelbv-spill.html 

27. May 22, Robertson County Times - (Tennessee) EPA reprimands Springfield. The 
Environmental Protection Agency (EPA) has notified Springfield, Tennessee, it is in 
violation of the Clean Water Act and immediately must fix its sewer system, the 
Robertson County Times reported May 22. The municipality has 5 years to reconstruct 
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and free its sewer of overflows caused by rainwater, roots, grease, and other blockages. 
Thousands of dollars in fines by the EPA will likely follow and property owners will 
have to spend money to correct problems that have been identified with their private 
sewers, said the water utility director. The Springfield Board of Mayor and Alderman 
approved a $6 million, 5-year plan to correct the problems. The director said any time 
there is an overflow into the sewer system, raw sewage discharges into the county’s 
creeks and rivers. The EPA enforcement action also requires the city to develop a 
capacity, management, operation, and maintenance plan. 

Source: 

http://www.tennessean.eom/article/20120523/ROBERTSON01/305230061/EPA- 

reprimands-Springfield 

28. May 22, Associated Press - (New Mexico) New Mexico says jet fuel spill could be 
larger. A 40-year-old jet fuel spill threatening Albuquerque, New Mexico’s water 
supply could be as large as 24 million gallons, or twice the size of the oil spill from the 
Exxon Valdez, environment officials said May 22. They previously estimated the spill 
from Kirtland Air Eorce Base to be 8 million gallons, however, a state geologist 
recently estimated it could be up to three times larger. The head of the New Mexico 
Environment Department’s resource protection division called the newest calculation a 
“first-order estimate” based on new data from Air Eorce monitoring wells. He 
emphasized the calculations have not been reviewed, and said no one will really know 
how large the spill is until it has been remediated. He was confident the spill can be 
cleaned. The leak was discovered in 1999. In 2007, the Air Eorce found the fuel had 
reached the water table and was moving off the base, beneath Albuquerque 
neighborhoods and toward the city’s water wells. Officials believe no contamination 
will reach city wells for at least 5 years, and the Air Eorce removed about 400,000 
gallons with hopes that broader remediation targeting the largest concentration of the 
spill could begin in summer 2012. 

Source: http://www2.wsls.com/news/2012/mav/22/new-mexico-savs-jet-fuel-spill- 
could-be-larger-ar- 1935589/ 
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Public Health and Healthcare Sector 



29. May 22, Wisconsin Department of Health Services - (Wisconsin) Health officials urge 
residents to seek pertussis vaccine. With summer camps and other programs for 
children starting in the next few weeks. State health officials are urging Wisconsin 
residents to seek pertussis vaccinations, according to a Wisconsin Department of 
Health Services release issued May 22. Wisconsin is experiencing a widespread 
outbreak of the disease, with 1,514 confirmed and probable cases to date. “The best 
defense against pertussis continues to be vaccination,” said the State health officer. 

“We recommend all Wisconsin residents check their vaccination status and schedule a 



visit to their healthcare providers if they have not yet been immunized against 
pertussis.” 

Source: http://www.dhs .Wisconsin. go v/News/PressReleases/20 1 2/0522 1 2.htm 
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30. May 22, Providence Journal - (Rhode Island) Hospital shuts unit after mysterious 
odor returns. Women and Infants Hospital in Providence, Rhode Island, once again 
relocated patients from the Labor-Delivery-Recovery (LDR) unit after a mysterious 
sweet odor sickened a small number of employees May 22. A few employees felt dizzy 
and nauseated. Six patients and their families moved to the South Pavilion, an area for 
high-risk patients that is equipped for labor and delivery. The hospital will replace the 
air-handling system in the LDR unit. The odor was first noticed and the unit evacuated 
April 25. Fire and environmental experts ruled out carbon monoxide, carbon dioxide, 
and methane. After cleaning, the unit reopened April 30. There were no further 
problems until May 22. Only a few staffers can smell the odor. 

Source: http://news.providencejournal.eom/breaking-news/2012/05/hospital-shuts.html 
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Government Facilities Sector 

3 1 . May 23, CNN - (Florida) Rashes at Florida school result in lockdown. A middle 
school in southern Florida was briefly placed on lockdown May 23 while a hazardous 
materials team responded to reports of rashes on four students and a teacher. The 
incident comes a week after another school in the district was also locked down after a 
series of rashes. In the May 23 incident at Lauderdale Lakes Middle School, the team 
did not find anything in the classroom where the rashes broke out, but the four affected 
students were taken to the hospital as a precaution, a Broward County School Board 
spokeswoman said. May 16, a similar incident occurred at McArthur High School, 
which is in the same district. A dozen students and two teachers were taken to the 
hospital but released shortly afterward. In that case, authorities concluded the rashes 
were not infectious. The high school was tested for 160 chemicals, mold, and mildew, 
but nothing was found, the spokeswoman said. 

Source: http://www.cnn.com/2012/Q5/23/us/florida-school-hazmat/index.html 

32. May 23, KPRC 2 Houston - (Texas; International) ‘Swatting’ believed to be behind 
Angleton High bomb threat. The FBI said six people from another country used 
Skype to make bomb threats May 1 1 against Angleton High School in Angleton, Texas, 
KPRC 2 Houston reported May 23. Investigators call it “swatting” when someone re- 
routes a Skype call and provokes a SWAT team to respond. Officials are now carrying 
out their investigation overseas. 

Source: http://www.click2houston.com/news/-Swatting-believed-to-be-behind- 
Angleton-High-bomb-threat/-/ 1735978/1 3708826/-/ 1 4k44r8/-/index .html 

33. May 22, Gilroy Dispatch - (California) Thief steals radio, causes bomb scare at 
Brownell. Brownell Middle School in Gilroy, California, was evacuated May 22 after 
an unknown thief broke into a classroom, stole a radio, and transmitted bomb threats 
over the school’s radio frequency. Gilroy police conducted a sweep of the campus to 
ensure there were no explosive devices. The county bomb squad was notified and put 
on standby. Brownell filed a police report a few weeks ago after an unknown suspect 
broke into one of its classrooms and stole a radio. May 22 was the first time since the 
break in that school staff heard voice traffic coming in via the stolen radio. The 
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schools’ resource officer was conducting a criminal investigation into the misuse of the 
radio and potential bomb threat, said a Gilroy police sergeant. All of Brownell’s radios 
were collected as of May 22. Staff will be re-issued new radios on new frequencies, “so 
we won’t have any more incidents,” said Brownell’s vice principal. 

Source: http://www.gilrovdispatch.com/news/crime fire courts/update-thief-steals- 
radio-causes-bomb-scare-at-brownell/article 0653810a-a43e-llel-81b9- 
0019bb30f31a.html 



For more stories, see items 7 , JA, and 44 
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Emergency Services Sector 

34. May 23, WRTV 6 Indianapolis - (Indiana) Broken security cameras alarm northeast 
side residents. Several security cameras that monitor neighborhoods in Indianapolis 
were not working, and officials said it could be a while before they are fixed, WRTV 6 
Indianapolis reported May 23. The city of Indianapolis put out bids for companies to 
install and maintain its network of security cameras. However, when the city could not 
afford the service, communities with high crime rates were left without police 
surveillance. Blackburn Terrace, one of the Indianapolis Housing Agency’s most 
challenged residential communities, is the only one in the system with security cameras 
tied into the city’s Homeland Security camera network. Since February 5, the city 
blocked officers from accessing the system on laptops. City officials said it could take 
up to 3 months to get the security cameras repaired. 

Source: http://www.theindvchannel.com/news/31Q99768/detail.html 

35. May 23, Tulsa World - (Oklahoma) Man tied to FBI bomb threat deemed insane. A 
Tulsa, Oklahoma man accused of threatening to kill several law enforcement officials 
and bomb the local FBI building was found not guilty by reason of insanity by a federal 
judge May 22. The suspect was suffering from a mental disorder at the time of his 
offenses that made him unable to appreciate the wrongfulness of his actions, according 
to a stipulation between the prosecution and defense accepted by a U.S. district judge. 

In a complaint originally sealed April 6, 201 1 federal prosecutors also accused the man 
of threatening to kill a former Tulsa County judge and law enforcement officers, 
including Tulsa FBI agents and employees, a State trooper, and the Sand Springs police 
chief. 

Source: 

http://www.tulsaworld.com/news/article. aspx?subjectid=14&articleid=201205 23 14 A 
10_ATulsa457165 
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Information Technology Sector 



36. May 23, The Register - (International) CompSci eggheads to map Android malware 
genome. Mobile security researchers are teaming up to share samples and data on 
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malware targeting the Android platform. The Android Malware Genome Project, led by 
a computer science researcher at North Carolina State University, aims to boost 
collaboration in defending against the growing menace of mobile malware targeting 
smartphones from companies such as HTC and Samsung that are based on Google’s 
mobile operating system platform. The North Carolina State team was the first to 
identify dozens of Android malware programs, including DroidKungFu and 
GingerMaster. The project is designed to facilitate the sharing of Android malware 
code between security researchers, along the same lines as the long-standing malware 
sample sharing projects already set up by Windows antivirus software developers. The 
project has already collected more than 1,200 pieces of Android malware. 

Source: http://www.theregister.co.uk/2012/05/23/android malware genome project/ 

37. May 23, H Security - (International) Wireshark updates close DoS security 
holes. Versions 1.6.8 and 1.4.13 of the open source Wireshark network protocol 
analyzer were released, fixing bugs and closing security holes. The maintenance and 
security updates to the cross-platform tool address three vulnerabilities that could be 
exploited by an attacker to cause a denial-of- service (DoS) condition. These include a 
memory allocation flaw in the DIAMETER dissector, infinite and large loops in eight 
other dissectors, and a memory alignment flaw when running on SPARC or Itanium 
processors. Eor an attack to be successful, an attacker must inject a malformed packet 
onto the wire or convince a victim to read a malformed packet trace file. Versions 1.4.0 
to 1.4.12 and 1.6.0 to 1.6.7 are affected; upgrading to 1.4.13 or 1.6.8 corrects these 
problems. 

Source: http://www.h-online.com/securitv/news/item/Wireshark-updates-close-DoS- 
security-holes- 1582717 .html 



38. May 23, Threatpost - (International) Anatomy of a LulzSec attack ‘singles out’ Web 
2.0 weakness. A new report analyzing a recent attack on a military dating site 
underscores the need for stronger safeguards on social networks. As part of its Hacker 
Intelligence Initiative, database and application security provider Imperva 
deconstructed a March attack by the hacker collective EulzSec on MilitarySingles.com. 
By bypassing simple checks and filters, the group was able to steal sensitive data, 
including passwords on more than 170,000 members of the dating site. The “reborn” 
group posted the attack on Pastebin March 26. The attackers took advantage of a 
vulnerable area in developing social applications: consumer-created content. In the case 
ofMilitarySingles.com, attackers leveraged the picture upload functionality. Hackers 
also took advantage of the dating site’s password management. Members’ secret codes 
were hashed with a weak MD5 algorithm and no additional salting to thwart a 
dictionary attack. 

Source: http://threatpost.com/en us/blogs/anatomv-lulzsec-attack-singles-out-web-20- 
weakness-052312 



39. May 22, Computerworld - (International) Windows Vista infection rates climb, says 
Microsoft. Microsoft said the week of May 14 that a skew toward more exploits on 
Windows Vista can be attributed to the demise of support for the operating system’s 
first service pack. Data from the company’s newest security intelligence report showed 
that in the second half of 2011, Vista Service Pack 1 (SPl) was 17 percent more likely 
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to be infected by malware than Windows XP SP3, the final upgrade to the nearly 1 1- 
year-old operating system. That is counter to the usual trend, which holds that newer 
editions of Windows are more secure, and thus exploited at a lower rate, than older 
versions such as XP. Some editions of Windows 7, for example, boast an infection rate 
half that of XP. The director of Microsoft’s Trustworthy Computing group attributed 
the rise of successful attacks on Vista SPl to the edition’s retirement from security 
support. Microsoft stopped delivering patches for Vista SPl in July 2011. For the bulk 
of the reporting period, then, Vista SP2 users did not receive fixes to flaws, including 
some that were later exploited by criminals. Vista SP2 will continue to be patched until 
mid- April 2017. 

Source: 

http://www.computerworld.eom/s/article/9227384AVindows Vista infection rates cli 
mb says Microsoft 

40. May 22, CNET News - (International) Google will alert users to DNSChanger 
malware infection. Google began to notify about half a million people their computers 
are infected with the DNSChanger malware. The effort, which began May 22, is 
designed to let those people know their Internet connections will stop working July 9, 
when temporary servers set up by the FBI to help DNSChanger victims are scheduled 
to be disconnected. “The warning will be at the top of the search results page for 
regular searches and image searches and news searches,” a Google security engineer 
said. 

Source: http://news.cnet.eom/8301-1009 3-57439407-83/google-will-alert-users-to- 
dnschanger-malware-infection/ 

41. May 22, TechSpot- (International) Blizzard: Battle.net account theft increase 
normal, hacking not issue. Blizzard responded to the recent upswing of stolen 
Battle.net accounts since the release of Diablo III. Although critics might be tempted to 
blame Blizzard’s security, the game company said every complaint it investigated led 
to a single conclusion: the thief had the user’s password. Although the true origins of 
recent account intrusions remain uncertain, it is highly probable that phishing, 
untrustworthy third-party software, and poorly protected passwords led to unauthorized 
account access. 

Source: http://www.techspot.com/news/48703-blizzard-battlenet-account-theft- 
increase-normal-hacking-not-issue.html 

42. May 22, Dark Reading - (International) Malware ‘licensing’ could stymie automated 
analysis. The Flashback trojan, which started spreading in September 2011, consists of 
a number of components, including a downloader that infects systems and modules 
fetched from Internet hosts to add functionality to the trojan. Such a division of labor is 
standard for botnets and trojan downloaders. However, the attack tool’s use of 
encryption to bind downloaded modules to the infected system — similar to how 
digital-rights -protected content is licensed and bound to a single playback device — is 
new. The problem for security firms and researchers is that encrypted malware makes 
automated malware analysis much harder, said a research scientist at the Georgia 
Institute of Technology’s Information Security Center. 
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Source: http://www.darkreading.com/advanced-threats/167901091/security/client- 
securitv/240000843/ 



For more stories, see items W and H 

Internet Alert Dashboard 

To report cyber infrastructure incidents or to request information, please contact US-CERT at sos@us-cert.gov or 
visit their Web site: http://www.us-cert. gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: https://www.it-isac.org 
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Communications Sector 

See items 36 and 38 
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Commercial Facilities Sector 



43. May 23, WRC 4 Washington D.C. - (Virginia) Fire intentionally set at Kohl’s store: 
Officials. A fire was intentionally started in a Kohl’s department store in the Herndon, 
Virginia area. May 22, fire investigators said. Fire and rescue units responded to the 
department store for a reported commercial structure fire. Firefighters found heavy 
smoke throughout the store when they arrived. They found a clothing rack on fire in the 
women’s section of the store, authorities said. Sprinklers had activated and put out the 
majority of the fire. Fire officials believed the fire was set intentionally and were 
continuing to investigate. 

Source: http://www.msnbc.msn.com/id/47538406/ns/local news- 
washington dc/#.T70o7FIvDzB 

44. May 22, Santa Cruz Sentinel - (California) Gas leak closes Front Street for hours, 
prompts evacuations, leaves Palomar residents without service. A natural gas leak 
in Santa Cruz, California, caused evacuations of shops and a museum, and left about 70 
residents of the Palomar building without hot water and natural gas for 6 hours. May 
22. The leak was discovered as contractors were refitting pipes. The crew momentarily 
left the job site and returned to find a man from the street leaning against the gas 
meters. The gas meter broke and the man ran off, authorities said. Firefighters 
evacuated the Santa Cruz Museum of Art and History, the Santa Cruz Chamber of 
Commerce offices, and several other shops after employees reported a strong smell of 
gas. Police also closed Front Street from Cooper Street to Soquel Avenue. A PG&E 
crew responded and was able to close the leak. Businesses and Front Street reopened 
about 2.5 hours after the leak was reported. 

Source: http://www.mercurvnews.com/breaking-news/ci 20681 122/gas-leak- 
investigation-prompts-street-closure-building-evacuations 
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45. May 21, Associated Press - (Missouri) 6 suffer minor injuries in fire at apartment 
complex near Missouri State University. Six people suffered minor injuries in a fire 
at an apartment complex near Missouri State University in Springfield, Missouri, May 
21. The blaze damaged most of the 15-unit complex. KSPR 33 Springfield reported that 
four victims were taken to a Springfield hospital and two were treated at the scene. 
Officials said all of the injuries were minor. 

Source: 

http://www.therepublic.eom/view/storv/f682eb6f514742ac9ea2e720f0cf0a9d/MO— 

Apartment-Fire-Springfield/ 

For more stories, see items 5 and 13 
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National Monuments and Icons Sector 

46. May 23, Salt Lake Tribune - (Utah) Hurricane wildfire burns 2,000 acres of 
southwestern Utah. Firefighters were gaining the upper hand on a wind-driven 
wildfire that had scorched an estimated 2,000 acres of southwestern Utah’s tinder-dry 
high desert. The fire, which began May 22, was burning in grass and sagebrush in hills 
that dot the area between Hurricane and Apple Valley. Nearby Highway 59 was closed 
for several hours as smoke billowed from the blaze, and flames were at one point 
moving toward homes in the Angel Heights and Rainbow Canyon areas in southeast 
Hurricane. However, winds shifted away from both the subdivision and highway, 
allowing traffic to resume and ending fears of a possible evacuation, public safety 
dispatchers said. “We’re calling it ‘human-caused,’ but don’t have specifics yet,” a 
Bureau of Land Management (BLM) spokesman said. In all, about 160 firefighters — a 
mix of BLM, Forest Service, Hurricane city, and local volunteer crews — fought the 
blaze through the night and into the morning. About half that number remained on the 
fire by the next morning. Crews had about 60-70 percent of their containment lines 
constructed by May 23. 

Source: http://www.sltrib.com/sltrib/news/541686Q3-78/fire-hurricane-wednesdav- 
utah.html. esp 

47. May 23, Reuters - (Nevada; Southwest) Fast-moving Nevada wildfire destroys seven 
homes. A fast-moving wildfire burned down seven homes in Nevada, May 22, as 
winds fanned the flames, and firefighters battling a series of dangerous blazes in the 
Southwest in dry weather and strong winds made slow progress. Firefighters said 
another 100 homes were threatened from a new blaze that blackened 3,500 acres of 
brush and forest in Douglas County, near the California border. More than 200 
firefighters battled the blaze with bulldozers on the ground and helicopters from the air. 
Blazes in rugged, mountainous areas of Arizona, New Mexico, and Colorado have 
already forced the evacuation of several small towns and torched more than 70 square 
miles of forest, brush, and grass in May. 

Source: http://www.reuters.eom/article/2012/05/23/us-usa-wildfires- 
idUSBRE84J00K20 1 20523 
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48. May 22, KUSA 9 Denver - (Colorado) Hewlett Fire now 100 percent 

contained. Firefighters brought a wildfire that had been burning in northern Colorado 
for more than a week under eomplete eontrol May 22. The Hewlett Fire is now 
considered 100 percent contained after burning an estimated 7,685 acres in the Poudre 
Canyon, northwest of Fort Collins. Firefighters said a camper using an alcohol fueled 
camping stove caused the fire May 14. The U.S. Forest Service plans to seek 
restitution. The cost of fighting the fire has surpassed $3 million. Dozens of homes 
were evacuated the week of May 14 as a precaution, but no structures were damaged by 
the fire. 

Source: http://www.9news.com/news/article/269046/222/Hewlett-Fire-now- 100- 
percent-contained 
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Dams Sector 



49. May 23, Mobile Press-Register - (Alabama) Flood fixes to help prevent flooding in 
Gulf Shores homes. The City of Gulf Shores, Alabama, approved a $18,750 contract 
for engineers to design a wider and deeper ditch on East 5th Street to handle 
stormwater and prevent future flooding of nearby neighborhoods, the Mobile Press- 
Register reported May 23. “It will be done very quickly because this is a high priority 
for the mayor and city council,” the city’s public works director said. The improved 
ditch will be able to handle storms that are equal to what have occurred in the past, 
officials said. The ditch will be widened and the sides and bottom will be lined with 
concrete block mats. Earlier in May a jury awarded $833,000 to 24 Gulf Shores 
homeowners who had sued the city for personal property repair costs and emotional 
distress caused by flooding from as many as three major storms in 2005 and 2007. In 
early April, the city agreed to buy 18 houses in the east Gulf Shores neighborhood. 
Source: http://blog.al.eom/live/2012/05/flood fixes to help prevent fl.html 
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